Pwns for sale: Scythe prepares a marketplace for sharing simulated hacks

Looks to make “adversarial vulnerability management” a thing, let red teams share their work.

Stock photo of a grocery store aisle.

Enlarge / Imagine a supermarket full of advanced persistent threats for your security team to throw at you. That's what Scythe is aiming to be. (credit: DigitalVision / Getty Images)

As we noted earlier this week, there's been a lot of action in the information-security industry around automation of tasks that typically get labelled as either penetration testing or "red teaming." The two are related but not quite the same—and there are obvious limits on how much can be passed off to an "as-a-service" type solution. But Ars has been looking at some of the early movers in security-testing tools for some time, and one is about to put a totally different spin on what "as-a-service" can do.

Penetration testing generally involves checking systems for vulnerabilities that can be exploited to gain access. Red teaming, on the other hand, tests the full spectrum of security by introducing human elements—social engineering with crafted phishing messages, exploiting information for further attacks, and the like. While they can benefit from automation, those are things that can't be fully passed off to a bunch of software robots in the cloud.

Scythe, a software company that spun out of the security-testing company Grimm, has been working for the past few years on a platform that allows corporate information-security teams to build security-testing campaigns—creating "synthetic malware" and crafting phishing campaigns or other attacks that mimic the techniques, tactics, and practices of known threat groups. And unlike some of the automated penetration-testing or threat-simulation products out there, Scythe retains the human in the loop—making it a useful tool to both internal security testers and external "red team" consultants.

Read 5 remaining paragraphs | Comments

This DIY Rotary Cellphone is a real thing that makes phone calls (but not much more)

Not every new cellphone has a 6+ inch display, an amazing camera or… a touchscreen display. Justine Haupt’s Rotary Cellphone puts some decidedly old-school tech into a modern mobile device that’s pocket-sized, capable of making phone …

Not every new cellphone has a 6+ inch display, an amazing camera or… a touchscreen display. Justine Haupt’s Rotary Cellphone puts some decidedly old-school tech into a modern mobile device that’s pocket-sized, capable of making phone calls, and which gets all-day battery life. Instead of a touchscreen though, it has a 10-digit dialer plus a […]

The post This DIY Rotary Cellphone is a real thing that makes phone calls (but not much more) appeared first on Liliputing.

February’s flexible flip-phone fight: The Galaxy Z Flip vs the Moto Razr

They’re releasing days apart, at similar prices, with different carriers in each corner.

This month marks the start of a heavyweight fight between Motorola and Samsung for the crown of "best foldable-display flip phone." Samsung and Motorola are both releasing normal-sized smartphones that fold in half, thanks to emerging flexible-display technology. The phones are releasing days apart, at similar price points, with different carriers backing each device.

So welcome to February's foldable flip-phone fight! In this corner, weighing in at $1,499, we have the nostalgia-infused Moto Razr, which launched February 6 as a Verizon exclusive. And in this corner, we have the first glass-covered foldable smartphone, the Samsung Galaxy Flip Z, which is launching a week later, February 14, as an AT&T and Sprint device for $1,380. FIGHT!

Both of these devices represent a second take on the foldable smartphone after the launch of the Galaxy Fold. Motorola takes the approach of doing away with a crease in the display, thanks to a collapsable hinge mechanism that folds the display into a gentle loop rather than a hard crease. Samsung, meanwhile, is the first to market with the holy grail for foldable smartphones: flexible glass. The Galaxy Z Flip's glass display cover can be folded in half just like the plastic display covers on other phones, but it provides more protection from scratches and punctures, along with feeling a lot smoother and harder than bubbly plastic.

Read 12 remaining paragraphs | Comments

LG and Samsung may be working on “Cloud Top” portable displays for smartphones

You can do a lot of things on a smartphone — but sometimes a bigger screen comes in handy for watching videos, editing documents, or performing other tasks that you’d normally do on a laptop or desktop computer. One solution is to buy a pho…

You can do a lot of things on a smartphone — but sometimes a bigger screen comes in handy for watching videos, editing documents, or performing other tasks that you’d normally do on a laptop or desktop computer. One solution is to buy a phone with a big screen — there are plenty of options […]

The post LG and Samsung may be working on “Cloud Top” portable displays for smartphones appeared first on Liliputing.

Valve: Half-Live Alyx erscheint am 23. März 2020

Nicht mehr lange, dann gibt es ein neues Half-Life: Valve hat offiziell bekannt gegeben, dass das Actionspiel Alyx am 23. März 2020 erscheint. Wer noch kein VR-Headset besitzt und spielen möchte, sollte sich allmählich um ein kompatibles Gerät kümmern….

Nicht mehr lange, dann gibt es ein neues Half-Life: Valve hat offiziell bekannt gegeben, dass das Actionspiel Alyx am 23. März 2020 erscheint. Wer noch kein VR-Headset besitzt und spielen möchte, sollte sich allmählich um ein kompatibles Gerät kümmern. (Half-Life, Steam)

US Govt: Massive Jetflicks Pirate Site Was Disguised as Aviation Service

After being shut down by the FBI, Jetflicks and associated site iStreamitAll were described by the US Government as two of the largest unauthorized streaming services in the United States. A new filing in the Jetflicks case now reveals that the giant pirate platform ran alongside a fledgling aviation video service that quite literally failed to get off the ground.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and more. We also have VPN reviews, discounts, offers and coupons.

In August 2019, eight men were indicted by a grand jury for conspiring to violate criminal copyright law by running “two of the largest unauthorized streaming services in the United States.”

Kristopher Lee Dallmann, Darryl Julius Polo, Douglas M. Courson, Felipe Garcia, Jared Edward Jaurequi, Peter H. Huber, Yoany Vaillant, and Luis Angel Villarino were the operators of Jetflicks, an unlicensed subscription-based TV show streaming service running out of Las Vegas, Nevada.

The defendants were charged with reproducing thousands of copyrighted TV shows and streaming them to customers all over the United States. Jetflicks reportedly had a massive library running to more than 183,000 episodes.

Last December, Darryl Julius Polo – who also ran another service called iStreamitAll – pleaded guilty to copyright infringement and money laundering charges. Alongside, Jetflicks programmer Luis Angel Villarino pleaded guilty to criminal copyright infringement.

The trial of the other defendants is set to go to trial in the summer, having been recently delayed due to Canadian authorities handing over a trove of discovery material. However, a legal matter involving Jetflick’s Kristopher Lee Dallmann has now provided an early glimpse into how that pirate streaming service was born.

As part of a US Government motion requesting confirmation that Dallmann waived his attorney-client privilege with respect to legal advice he received on the operation of Jetflicks, an FBI agent’s affidavit reveals what was said by Dallmann during the execution of a search warrant on his Las Vegas home on November 16, 2017.

Under questioning, Dallmann told the agent that the FBI misunderstood the nature of Jetflicks, claiming it was an entity providing aviation services.

“[Dallmann] described Jetflicks as a service through which customers could put their personal DVD collection onto a mobile device that could be utilized on aircraft,” the agent explained, adding that Dallman said that Jetflicks provided “minimal streaming services” and that its primary source of income came from digitizing personal DVD collections.

During the interview, Dallmann said that Jetflicks only ever had two customers, who combined paid a total of $80,000. Later, however, the Las Vegas resident admitted to streaming TV shows without permission but said that was permissible under the law since if a complaint was received, he would remove the content.

Following a pause in the interview, during which Dallmann used the bathroom, the tone appeared to change. The FBI agent reports Dallmann as weeping while admitting that he hadn’t been telling the entire truth. The Jetflicks business, or the DVD digitization service at least, hadn’t been successful and as a result, he’d turned to downloading TV shows from various websites and streaming them illegally via Jetflicks.

Dallmann volunteered that he had sought legal advice from an unnamed attorney who told him that Jetflicks could operate legally as long as content was taken down following a copyright complaint. However, Dallmann also admitted to receiving a cease-and-desist notice sent by the MPAA but said that the same attorney advised him to ignore it, dismissing the correspondence as having been “written by an amateur”.

According to the US Government, the illegal Jetflicks streaming operation and DVD digitization project (named as Jetflicks MoVi Entertainment System) ran alongside each other. The premise for the latter was that Dallmann “would contract with private aircraft owners to digitize their personal DVD collections of movies and television shows so they could watch their favorite movies and shows on digital devices on their planes.”

Interestingly, it’s reported that the Jetflicks MoVi Entertainment System was being built with copyright in mind. Promotional material seized by the FBI stated that Jetflicks would need to inspect a customer’s DVD collection to ensure that all original copies were owned before a customer’s new digital system could be populated.

“This aviation-services business, however, never got off the ground,” the motion reads.

“So, Mr. Dallmann and other conspirators quickly realized that it was much more lucrative to run and expand what amounted to an illegal version of Netflix, that is, a service where they obtained infringing digital copies of television shows from pirate sites, processed and renamed those works, and then streamed and distributed them on an unlimited basis to paying subscribers.”

While the aviation business failed, it’s claimed that the defendants used its identity to ensure that banks and payment processors for the streaming business carried on supplying their services.

According to the Government, Dallmann and his co-conspirators told service providers that their business focused on in-flight entertainment, referring them to Jetflicks.com rather than the Jetflicks.mobi domain used by the streaming entity.

Archive image from Jetflicks.com

“For example, beginning in November 2016, Jetflicks used a company called Stripe to process subscriptions for the jetflicks.mobi illegal streaming service,” the motion reads.

“However, the Jetflicks Stripe account listed the domain as ‘jetflicks.com’ and Mr. Dallmann described his business to Stripe as follows: ‘Private and Corporate aviation entertainment system sales, service, and subscription services. We invented the first entertainment system for private aviation that is classified as carry-on equipment’.”

Dallmann reportedly made a further statement to Stripe, shortly after opening the account, that his “aviation” business had 3,500 active customers. An application for a Wells Fargo account had Dallmann stating his business as “In flight entertainment for private jets.”

The untruths apparently continued when Jetflicks responded to streaming customers who complained that certain TV shows weren’t available on the service. They were told that the service’s “legal department” were negotiating contracts with copyright owners and that in some cases “a lot of red tape” was involved.

One customer who asked about the show True Blood was reportedly told that “Contract renewals and negotiations are in progress with HBO. They have a new HBO-ToGo mobile phone app now… so you can understand how they want it all on their app now. We will keep working on it but nothing moves fast with that sort of thing.”

The trial of the six remaining defendants is set to go ahead in July 2020.

The US Government’s motion and supporting affidavit can be found here and here (pdf)

Source: TF, for the latest info on copyright, file-sharing, torrent sites and more. We also have VPN reviews, discounts, offers and coupons.

Amazon wins court injunction on controversial JEDI contract

Amazon’s suit argues it lost the deal because Trump personally hates Jeff Bezos.

Amazon wins court injunction on controversial JEDI contract

Enlarge

Cloud-computing and retail behemoth Amazon won a legal victory today against rival Microsoft, as a federal judge agreed to order a hold on a massive federal contract Microsoft was awarded late last year.

Amazon late last year filed suit against the Trump administration over the Joint Enterprise Defense Infrastructure (JEDI) cloud-computing contract. Amazon last month asked the court to grant a temporary injunction halting any JEDI work while the case is pending, and today Judge Patricia Campbell-Smith agreed. Although the existence of the injunction is public, documents relating to the matter are presently sealed.

The JEDI contract is a $10 billion agreement to build a cloud computing and storage platform for use by the entire Department of Defense. Several firms were in the running for the deal, including Oracle and IBM. in April, the DoD dropped the list of finalist candidates to two: Amazon's AWS and Microsoft's Azure. AWS was widely expected to seal the deal, and so industry-watchers were surprised when in October Microsoft nabbed the contract instead.

Read 3 remaining paragraphs | Comments

Google’s GameSnacks are web games optimizes for slow internet connections

While smartphones have become a global phenomenon in recent years, speedy internet access isn’t quite as universal — many folks are still relying on relatively slow 2G or 3G wireless networks. So while many mobile app and web developers are…

While smartphones have become a global phenomenon in recent years, speedy internet access isn’t quite as universal — many folks are still relying on relatively slow 2G or 3G wireless networks. So while many mobile app and web developers are taking advantage of the possibilities of high-speed wireless internet access, one of Google’s latest projects […]

The post Google’s GameSnacks are web games optimizes for slow internet connections appeared first on Liliputing.

Half-Life: Alyx is one step closer to existing with firm release date

Three weeks before launch, special hints will arrive as SteamVR “Home” spaces.

Valve's first announcements about its upcoming, VR-exclusive game Half-Life: Alyx included a vague launch window of March 2020. In a world where Valve game delays are the rule rather than the exception, a lack of a firm release date was enough to make the developers' fans anxious about Valve Time rearing its head again.

On Thursday, Valve made weaseling out of its announced plans a bit tougher, as the company confirmed a firm release date for HLA: March 23, 2020.

The announcement first appeared on the company's social media feed, and as of press time, the exact date has yet to appear on either the game's official site nor its Steam sales listing. Today's news also came with a brief gallery of brand-new game images. While they don't point to any new gameplay mechanics, they're a welcome look into a virtual world that looks plenty authentic to the beloved Half-Life universe.

Read 3 remaining paragraphs | Comments

Wi-Fi 6E isn’t here yet—but Broadcom is clearly banking on it

There’s no official Wi-Fi 6E timeline yet, but FCC approval seems likely.

Today, Broadcom announced the availability of a new phone-targeted Wi-Fi chipset, the BCM4389. The new chipset offers support for Wi-Fi 6 and—more interestingly—Wi-Fi 6E.

For those who aren't immediately familiar with the latest bit of alphabet soup, Wi-Fi 6E isn't a new protocol at all. Instead, it's a branding name for 1200MHz of additional spectrum in the 6GHz range. The FCC hasn't yet formally approved the public use of this spectrum, but its chairman Ajit Pai expressed a desire for the agency to "move quickly" in approving it in September. Broadcom's decision to go ahead with designing and releasing actual hardware for use on the spectrum clearly strongly anticipates 6E becoming "a thing" sometime this year.

We're going to spend a little time talking about why Wi-Fi 6E is important before diving into features specific to BCM4389 itself—which go well beyond a simple "connects to 6E if available."

Read 16 remaining paragraphs | Comments